Which TWO statements about syslog priorities and how rsyslog selectors match them are correct? (Choose two.)
LPIC-1 Exam 102-500, objective 108. Essential system services medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Choose 2.
Correct A selector of `cron.err` matches cron messages of severity err and of every more severe level up to emerg.
Correct. A bare priority in a selector means that level and everything above it, which is why `*.info` is such a broad catch-all.
Correct `emerg` is the most severe level and `debug` the least severe.
Correct. The ordering, from most to least severe, is emerg, alert, crit, err, warning, notice, info, debug.
Not correct The numeric severity codes run from 0 for debug up to 7 for emerg.
Wrong, and reversed. The wire encoding gives emerg the value 0 and debug the value 7, so a lower number means a more urgent message. That is also why `journalctl -p 3` means err and above.
Not correct `*.=err` selects err and everything above it.
Wrong. The equals sign restricts the match to exactly that one severity, so this rule catches err alone and lets crit, alert and emerg go elsewhere.
Not correct `warn` and `warning` denote two different severities.
Wrong. They are the same level; warn is the deprecated spelling, as are error for err and panic for emerg.
Why
Two things trip candidates up here: the default and-above sense of a bare priority, and the fact that the numeric codes run the opposite way to the intuitive ordering. Both matter in practice, because journalctl's -p option takes the numbers as well as the names and inherits the same and-above rule. The modifiers to remember are = for exactly this level, ! for negation, and the keyword none for nothing at all.
Where this comes from
- Cited
- manual page rsyslog.conf(5)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked